topic Re: What is the eval command doing in this search? in Splunk Search

What is the eval command doing in this search?

nagarjuna280 — Sun, 27 Nov 2016 09:37:53 GMT

We use eval command to create new field, and we used this as function ex: |stats count(eval(method="GET")) as get. Can someone explain this example clearly? What is eval doing here?

Re: What is the eval command doing in this search?

martin_mueller — Sun, 27 Nov 2016 10:37:21 GMT

count(eval()) is testing the boolean expression inside the eval() and only counting those events that yield true, ie those with method="GET".

Re: What is the eval command doing in this search?

ddrillic — Sun, 27 Nov 2016 23:01:57 GMT

The manual explains it at Use stats with eval expressions and functions

One example there is -

status=404 | stats dc(eval(if(status=404, ip, NULL))) AS dc_ip

your method="GET" is a shortcut for the if(method="GET",1,0) command.

Re: What is the eval command doing in this search?

nagarjuna280 — Mon, 28 Nov 2016 18:14:12 GMT

|eval newitem=if(status=404, ip, null)
it returns "ip"
then we can use | stats dc(newItem).

what does eval do after returning an argument (ip). like |stats dc(eval(ip))

meaning of eval(ip) ?

Re: What is the eval command doing in this search?

martin_mueller — Mon, 28 Nov 2016 18:18:30 GMT

| stats dc(eval(ip)) is the same as | stats dc(ip).

Re: What is the eval command doing in this search?

nagarjuna280 — Mon, 28 Nov 2016 18:29:29 GMT

what does eval(ip) return?

Re: What is the eval command doing in this search?

martin_mueller — Mon, 28 Nov 2016 18:37:31 GMT

eval(ip) evaluates the expression ip, so it returns ip.

Re: What is the eval command doing in this search?

nagarjuna280 — Tue, 29 Sep 2020 11:56:41 GMT

as you said "| stats dc(eval(ip)) is the same as | stats dc(ip)"

if(method="GET", 0 ,1) return 0 or 1

then dc(eval(0)) should be same as dc (0)

sourcetype=access_combined* |stats dc(eval(if(method="GET", 0 ,1))) as dc_method

should be same as sourcetype=access_combined* |stats dc(if(method="GET", 0 ,1)) as dc_method

but not showing 0 results (last one)

Re: What is the eval command doing in this search?

nagarjuna280 — Tue, 29 Sep 2020 11:56:31 GMT

as you said "| stats dc(eval(ip)) is the same as | stats dc(ip)"

if(method="GET", 0 ,1) return 0 or 1

then dc(eval(0)) should be same as dc (0)

sourcetype=access_combined* |stats dc(eval(if(method="GET", 0 ,1))) as dc_method

giving 2 as count

should be same as sourcetype=access_combined* |stats dc(if(method="GET", 0 ,1)) as dc_method

0 as count
but showing 0 results (last one)

Re: What is the eval command doing in this search?

martin_mueller — Mon, 28 Nov 2016 19:24:05 GMT

That's because in the first case, there's an eval() function to evaluate the if() expression, while in the second case there isn't.

eval(if(method="GET", 0, 1)) evaluates to 0 if the method is GET, to 1 otherwise.